Add hashi_vault pki backend support

This patch defines necessary variables for the 'hashi_vault' pki backend
which is the alternative to the default 'standalone' backend.

Additionally, it:
- changes the format of `placement_pki_san` to the new one changed in [1]
- passes `pki_default_backend` when trigerring PKI role so its aware of
the default backend in case it's not explicitly specified in the cert
definition.
- adopts this role to the recent changes in PKI role [2][3][4]

[1] https://review.opendev.org/c/openstack/openstack-ansible/+/948886
[2] fc7db02074
[3] 7cff89ee71
[4] f03bcc19d5

Change-Id: I695754bafe29778feb3b47710d5f363d2ce11870
Signed-off-by: Damian Dabrowski <damian.dabrowski@cleura.com>

defaults/main.yml

@@ -278,12 +278,14 @@ barbican_pki_keys_path: "{{ barbican_pki_dir ~ '/certs/private/' }}"
 barbican_pki_certs_path: "{{ barbican_pki_dir ~ '/certs/certs/' }}"
 barbican_pki_intermediate_cert_name: "{{ openstack_pki_service_intermediate_cert_name | default('ExampleCorpIntermediate') }}"
 barbican_pki_regen_cert: ""
-barbican_pki_san: "{{ openstack_pki_san | default('DNS:' ~ ansible_facts['hostname'] ~ ',IP:' ~ management_address) }}"
+barbican_pki_san: "{{ openstack_pki_san | default({'dns': [ansible_facts['hostname']], 'ip': [management_address]}) }}"
+barbican_pki_backend: "{{ openstack_pki_backend | default('standalone') }}"
 barbican_pki_certificates:
   - name: "barbican_{{ ansible_facts['hostname'] }}"
-    provider: ownca
     cn: "{{ ansible_facts['hostname'] }}"
     san: "{{ barbican_pki_san }}"
+    # standalone backend only
+    provider: ownca
     signed_by: "{{ barbican_pki_intermediate_cert_name }}"
 
 # barbican destination files for SSL certificates
@@ -292,17 +294,21 @@ barbican_ssl_key: /etc/barbican/barbican.key
 
 # Installation details for SSL certificates
 barbican_pki_install_certificates:
-  - src: "{{ barbican_user_ssl_cert | default(barbican_pki_certs_path ~ 'barbican_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
+  - name: "barbican_{{ ansible_facts['hostname'] }}"
+    type: "certificate_chain"
     dest: "{{ barbican_ssl_cert }}"
     owner: "{{ barbican_system_user_name }}"
     group: "{{ barbican_system_user_name }}"
-    mode: "0644"
-  - src: "{{ barbican_user_ssl_key | default(barbican_pki_keys_path ~ 'barbican_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
+    # standalone backend only
+    src: "{{ barbican_user_ssl_cert | default(barbican_pki_certs_path ~ 'barbican_' ~ ansible_facts['hostname'] ~ '-chain.crt') }}"
+  - name: "barbican_{{ ansible_facts['hostname'] }}"
+    type: "private_key"
     dest: "{{ barbican_ssl_key }}"
     owner: "{{ barbican_system_user_name }}"
     group: "{{ barbican_system_user_name }}"
-    mode: "0600"
+    # standalone backend only
+    src: "{{ barbican_user_ssl_key | default(barbican_pki_keys_path ~ 'barbican_' ~ ansible_facts['hostname'] ~ '.key.pem') }}"
 
 # Define user-provided SSL certificates
-# barbican_user_ssl_cert: <path to cert on ansible deployment host>
-# barbican_user_ssl_key: <path to cert on ansible deployment host>
+barbican_user_ssl_cert: ""
+barbican_user_ssl_key: ""

tasks/main.yml

@@ -112,9 +112,10 @@
         - barbican-config
         - pki
   vars:
+    pki_backend: "{{ barbican_pki_backend }}"
     pki_setup_host: "{{ barbican_pki_setup_host }}"
     pki_dir: "{{ barbican_pki_dir }}"
-    pki_create_certificates: "{{ barbican_user_ssl_cert is not defined and barbican_user_ssl_key is not defined }}"
+    pki_create_certificates: "{{ barbican_user_ssl_cert | length == 0 and barbican_user_ssl_key | length == 0 }}"
     pki_regen_cert: "{{ barbican_pki_regen_cert }}"
     pki_certificates: "{{ barbican_pki_certificates }}"
     pki_install_certificates: "{{ barbican_pki_install_certificates }}"